Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Medium
Researchers have published an analysis of the Team9 (aka Bazar) backdoor and loader. The infection begins with a loader, two variants of which were analyzed previously. The earlier variant downloads the backdoor using Windows BITS, which is no longer the case. Additionally the strings are not encrypted and the Windows API functions are not loaded dynamically. After ensuring no existing infections are present, the loader establishes persistence using a Registry Run key. It then covers its tracks by deleting itself via a batch file. The victim host’s architecture is identified and the associated backdoor component is downloaded from one of two hard-coded C2 servers. If the downloaded version is 32-bit, it is injected into calc.exe using process hollowing. Otherwise it is written to disk and executed. The newer variant of the loader operates similarly but adds in string encryption and dynamic loading of the Windows API functions. Process injection now occurs with both architectures; svchost, explorer, and cmd are the target processes. Additional persistence mechanisms are implemented including scheduled tasks, Winlogon hijacking, and Startup folder shortcuts. The analysis of the downloaded backdoors shows C2 communication occurs over ports 80 and 443. It is capable of receiving commands that allow for system information collection, downloading and execution of files and scripts, file exfiltration, and more.